Introduction

Security Review is a service provided Firefox Security Engineering to review the design of features to ensure appropriate consideration of threats, and mitigation of common security flaws. Security Review is usually performed towards the end of a design of a feature, prior to implementation. To request a security review, send an email to secreview@mozilla.com following the process below.

Process

1. Make a copy of the security review template and fill in the sections.
   • The first section of the template is not asking you to create new documentation; rather, we assume you have done this level of planning and will be able to share links to existing documents. If you don't have this documentation your feature may not be defined well enough to conduct a productive review. Send us mail and we can talk about it: maybe you need something less formal than a "review".
   • Please share the completed request document with secreview@mozilla.com and grant Editor access. We will use this document to take meeting notes.
2. Send an email to secreview@mozilla.com to request a review, linking to the filled-in request document
3. Feature EPM or dev lead will schedule a meeting to review details and discuss risks
4. Follow-up items: Fixing issues, and optionally Security Testing

FAQ

Do I need to do a security review ship a feature?

No, this process is optional, to assist teams with understanding security issues related to their features. However this process is strongly encouraged for any security sensitive features i.e. those involving sensitive user data (PII or passwords), or features which involve browser security mechanisms like TLS, dom security APIs, permissions etc.

What is the difference between Security Review and Security Testing

Security review is a high level design review intended to ensure that a feature considers all risks as part of the building of a feature. Security Testing is specific testing of a feature once it is built to ensure that it is free of common implementation flaws, and also that any security controls critical to the feature are functioning correctly.

Legacy Reviews

Old Security Review can be found here: Security/Archived/Reviews/